生成ssl自签证书

 1、创建根私钥、证书和证书请求文件

 

openssl genrsa -out private.key 2048
openssl req -new -key private.key -out server.csr
openssl x509 -req -days 3650 -in server.csr -signkey private.key -out server.crt

2、nginx配置参考

        listen       443 ssl default;
        server_name  172.30.195.217 xc-pro.iflytek.work;

        ssl_certificate  /idp/public/nginx/conf/ssl/dev/server.crt;
        ssl_certificate_key  /idp/public/nginx/conf/ssl/dev/private.key;
        ssl_session_timeout  5m;

2、参考日志：

[root@nginx ssl]# mkdir -p /usr/local/nginx/ssl
[root@nginx ssl]# cd /usr/local/nginx/ssl
total 0
[root@nginx ssl]# openssl genrsa -out private.key 2048
Generating RSA private key, 2048 bit long modulus
...................+++
.........................................................................................................................................+++
e is 65537 (0x10001)
[root@nginx ssl]# openssl req -new -key private.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:zh
State or Province Name (full name) []:anhui
Locality Name (eg, city) [Default City]:hefei
Organization Name (eg, company) [Default Company Ltd]:idp
Organizational Unit Name (eg, section) []:yth
Common Name (eg, your name or your server's hostname) []:xc-pro.iflytek.work
Email Address []:623243335@qq.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:Cfpl@1wl
An optional company name []:Cfpl@1wl
[root@nginx ssl]# openssl x509 -req -days 3650 -in server.csr -signkey private.key -out server.crt
Signature ok
subject=/C=zh/ST=anhui/L=hefei/O=idp/OU=yth/CN=xc-pro.iflytek.work/emailAddress=623243335@qq.com
Getting Private key
[root@nginx ssl]# ll
total 12
-rw-r----- 1 root root 1675 Aug 28 16:04 private.key
-rw-r----- 1 root root 1294 Aug 28 16:06 server.crt
-rw-r----- 1 root root 1119 Aug 28 16:05 server.csr
[root@nginx ssl]# 
[root@nginx ssl]# 
[root@nginx ssl]# cd ../../sites/
[root@nginx sites]# ll
total 8
-rw-r----- 1 root root 1253 Aug 28 15:43 443.conf_bak
-rwxr-xr-x 1 root root 3734 Aug 28 14:57 80.conf
[root@nginx sites]# 
[root@nginx sites]# vim 443.conf_bak 
172.30.195.217_2023082816:08:38.log,[root@nginx sites]# ll
total 8
-rw-r----- 1 root root 1249 Aug 28 16:07 443.conf_bak
-rwxr-xr-x 1 root root 3734 Aug 28 14:57 80.conf
[root@nginx sites]# mv 443.conf_bak 443.conf
[root@nginx sites]# chmod 755 443.conf 
[root@nginx sites]# ll
total 8
-rwxr-xr-x 1 root root 1249 Aug 28 16:07 443.conf
-rwxr-xr-x 1 root root 3734 Aug 28 14:57 80.conf
[root@nginx sites]# 
[root@nginx sites]# 
[root@nginx sbin]# cd ../conf/sites/
[root@nginx sites]# vim 443.conf 

[root@nginx sites]# cd ../../sbin/
[root@nginx sbin]# ./nginx -t
nginx: the configuration file /idp/public/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /idp/public/nginx/conf/nginx.conf test is successful
[root@nginx sbin]# ./nginx -s reload